ESMA's interim MiCA register lists 367 authorised crypto-asset service providers across 27 home states, based on the files ESMA publishes weekly, as downloaded on 12 October 2026. Germany alone accounts for 100 of them. Only 73 authorisations are dated after the transitional period ended on 1 July 2026, compared with 76 in June alone.
That makes the register the first place to look when you onboard a crypto provider, but it also makes it easy to misread. This guide shows what's in the files, who's on them, and six traps that make a quick check misleading. It ends with a check sheet you can reuse for every provider.
Every figure below comes from ESMA's own CSV files (current as of 12 October 2026).
What the register is, and isn't
Articles 109 and 110 of MiCA require ESMA to publish a central register of authorised CASPs and of non-compliant entities. To meet its deadline of 30 December 2024, ESMA published an interim version as CSV files on its MiCA page.
The page lists five files: white papers for crypto-assets other than ARTs and EMTs, issuers of asset-referenced tokens, issuers of e-money tokens, authorised CASPs, and non-compliant entities. ESMA says it publishes the latest version weekly, and that the CSV files remain the format until the register moves into its IT systems, planned for mid-2026. Check the page for where the register lives now.
Three limits matter from day one:
- The register reflects what authorities report. ESMA says records mirror what the authorising authority notified, and that information reported by authorities or shown in national registers may not appear straight away.
- It's a list of authorisations, not a safety rating. It tells you whether a firm is authorised, not how well it's run.
- Withdrawn authorisations don't disappear. They stay listed, with the date the withdrawal took effect.
The transitional period is over. ESMA says firms operating under national law before 30 December 2024 could continue only until 1 July 2026, or until their MiCA application was granted or refused. After that date, a provider that isn't on the register generally shouldn't be serving EU clients.
Who's on the register
The authorised file holds 370 rows covering 367 distinct entities, with home states across 27 EU and EEA countries.
| Home state | Entities |
| Germany | 100 |
| France | 36 |
| Netherlands | 29 |
| Cyprus | 25 |
| Malta | 23 |
| Spain | 15 |
| Luxembourg | 13 |
| Czechia, Ireland, Liechtenstein, Latvia | 12 each |
| Austria | 11 |
The top five states account for about 58% of entities, and Germany alone for about 27%.
What kinds of firms
The register is organised by legal entity, so there's no "type" field. As a rough guide, we flagged legal names containing bank-type words (bank, Sparkasse, Volksbank, Raiffeisen, eG, caixa and similar). That pattern catches 88 of 367 entities (24%). Of those, 66 are in Germany, where it covers two-thirds of entries. Across the other 26 states it catches 22 of 267 (about 8%).
So Germany's total looks driven by banks adding crypto services, while elsewhere the register is mostly non-bank providers. Treat these as estimates, because a name pattern will miss and mis-flag some firms.
When they were authorised
The authorisation dates in the file show a rush before the deadline and a slowdown after it:
| Period | Authorisations dated in period |
| Before 1 January 2026 | 152 |
| 1 January to 30 June 2026 | 142 |
| of which June 2026 | 76 |
| 1 July to 12 October 2026 | 73 |
| of which July / August / September | 33 / 18 / 16 |
These are row counts by authorisation date, not the date ESMA added the record. Even so, the pattern is clear: 294 authorisations are dated on or before 30 June, and the monthly pace has roughly halved since July.
What they're authorised to do
The file records services as lettered categories. These counts show how many entities list each one. They're lower bounds, because 19 entities' service cells didn't parse with a simple pattern.
| Service | Entities |
| a. Custody and administration | 212 |
| j. Transfer services | 198 |
| e. Execution of orders | 189 |
| c. Exchange of crypto-assets for funds | 171 |
| d. Exchange of crypto-assets for other crypto-assets | 141 |
| g. Reception and transmission of orders | 82 |
| i. Portfolio management | 48 |
| h. Advice | 37 |
| f. Placing | 34 |
| b. Operation of a trading platform | 21 |
For payments, the combination matters. 198 entities list transfer services, and 138 of those also list exchange for funds. If you need both, that's the subset to look at. Meanwhile 57 entities appear to hold order execution only, which is no use if you need custody or fiat conversion.
How to read a row
ESMA publishes a field description file alongside the register. These are the fields that matter when you're checking a provider:
| Field | What it tells you |
| ae_competentAuthority | The authority that granted the authorisation |
| ae_homeMemberState | The firm's home state |
| ae_lei_name | The legal name |
| ae_lei | The 20-character Legal Entity Identifier |
| ae_commercial_name | The trading name |
| ae_website | The firm's website |
| ac_authorisationNotificationDate | When the authorisation was notified |
| ac_authorisationEndDate | When it was withdrawn, if it was |
| ac_serviceCode | The services covered |
| ac_serviceCode_cou | The states where the firm intends to provide them |
| ac_comments | Notes on updates |
| ac_lastupdate | When the record last changed |
Six traps that make a quick check misleading
1. The data is messy
Separators vary: pipes with spaces, pipes without, tabs and trailing full stops all appear. Three entities have no LEI at all, and three LEIs appear on two rows each, with different dates. A spreadsheet filter will miss some of them.
What to do: search by LEI first, then by legal name and country, and read every row you find.
2. The brand isn't the legal entity
The register is organised by legal entity, but you probably know the provider by its brand. After ignoring company suffixes, about 48 of 370 rows list a commercial name that materially differs from the legal name, and 26 rows have no commercial name at all.
What to do: match the LEI name to the entity on your contract, not the name on the website.
3. "Authorised" doesn't mean authorised for your service
Authorisation covers specific services. Only about 6% of entities (21, on the parsed count) list operating a trading platform, and 57 appear to hold order execution only.
What to do: check that the service cell includes what you're buying, whether that's custody, exchange for funds or transfers.
4. Authorised in one country isn't authorised to serve yours
The file lists the states where a firm intends to provide each service. Of 370 rows, 144 list a single country, 171 list 25 or more, 38 list between two and nine, 13 list between 10 and 24, and 4 list none.
What to do: check that the countries you operate in are on the list. If they aren't, ask the provider how it will serve you.
5. Withdrawn authorisations stay on the list, and the file has errors
Two entries carry end dates: one in Cyprus (24 April 2026) and one in the Netherlands (26 March 2026). They remain listed, so a name match alone isn't proof of a live authorisation. The file also has typos. Two rows carry future authorisation dates, including one in 2028.
What to do: check the end-date field on every match, and treat odd dates as a reason to confirm with the home authority.
6. The register lags reality
Records reflect what authorities report, and ESMA warns they may not appear straight away. A firm authorised last week may not be listed yet, and the file is only as current as the reports behind it.
What to do: cross-check the home authority's own register, and ask the provider for the authorisation decision reference.
The non-compliant list
Article 110 makes ESMA maintain a register of providers operating in breach of Articles 59 or 61. ESMA says the list isn't meant to be complete, and each entry must at least show a trading name or website and the authority that reported it.
The non-compliant file has 173 entries, dated from February 2025 to September 2026. Seven decisions are dated after 1 July 2026. What stands out is where they come from:
| Reporting authority | Entries |
| Italy (CONSOB) | 164 |
| Belgium (FSMA) | 6 |
| Czechia, Netherlands, Slovakia | 1 each |
Five authorities in five countries have contributed, and Italy accounts for about 95%. Every entry lacks an LEI, 165 give no reason, and all 173 show "No" in the field ESMA describes as recording whether it identified an infringement itself. In other words, these are national warnings identified mostly by website, not ESMA findings about named companies.
Two consequences follow. Check by domain, since there's no LEI to search on. And absence from this list tells you very little: 22 other states' authorities have contributed nothing, so a provider that's missing from both registers isn't "clean". It's simply unverified.
How to check a provider, step by step
- Get the facts in writing. Ask the provider for its legal entity name, LEI, home authority and the specific services and countries it's authorised for.
- Download the current files. Take the latest authorised-CASP and non-compliant files from ESMA's MiCA page, and note the date.
- Search by LEI, then name. Read every matching row, not just the first.
- Match the entity. Compare the LEI name to your contract, and the website to the provider's real domain.
- Match the services and countries. The service cell must include what you're buying, and the country list must include where you operate.
- Check the dates. The end-date field should be blank, and the last-update date should look plausible. Query anything odd with the home authority.
- Search the non-compliant file by domain. Remember that a clean result proves little.
- Cross-check the home authority's register. National registers can be ahead of ESMA's. For example, France's AMF publishes a white list with a CASP category, and Malta's MFSA runs a searchable Financial Services Register.
- Record it. Keep the file date, the row details and who checked, and re-run the check at renewal and after any change of entity or services.
An illustrative row, with invented values, shows what a good match looks like:
| Field | Example value | Check |
| ae_lei_name | Example Payments GmbH | Matches the contract |
| ae_lei | (20-character code) | Matches what the provider gave you |
| ae_commercial_name | ExamplePay | Matches the brand you know |
| ac_serviceCode | a, c, j | Covers custody, exchange for funds and transfers |
| ac_serviceCode_cou | DE | AT |
| ac_authorisationEndDate | (blank) | No withdrawal |
If the provider isn't listed
Don't treat "not listed" as a final answer. Ask for the home authority's authorisation reference and date, since a recent decision may not have reached the register yet. Ask whether the firm has applied and what its status is.
An application isn't an authorisation, and the transitional period is over. Under the AMF's guidance on the end of the transition, firms that haven't been authorised and can't continue should be winding down, and non-EU entities can't serve EU clients except under the narrow reverse-solicitation exemption. CASPs also can't outsource services such as custody to unauthorised firms.
If a provider tells you it works under a partner's licence, apply the same check to the partner. Our guide to what a white-label payment gateway is explains who holds the licence in that setup.
Until the answer is clear, don't onboard.
Limits of the register
- Interim files. ESMA calls this an interim register, and the file has quirks, including a misspelled field name and the date errors above.
- Uneven reporting. Authorities report in different ways. The non-compliant file in particular reflects a handful of authorities.
- Snapshots date quickly. Counts here reflect the 12 October 2026 download, and ESMA updates weekly. Re-run any figure before you rely on it.
Your provider check sheet
Copy this for each provider and keep it with your onboarding records.
| Check | Result | Pass? |
| Legal entity name matches the contract | ||
| LEI matches the provider's own statement | ||
| Found in ESMA's authorised file (file date: ) | ||
| Every matching row read | ||
| Services cover what we're buying | ||
| Countries cover where we operate | ||
| End date blank | ||
| Dates plausible; queries sent to home authority | ||
| Home authority's own register checked | ||
| Domain not in the non-compliant file | ||
| Authorisation reference received |
How to read the result:
- Green: every check passes and the home authority's register agrees.
- Amber: the firm is listed, but the name, service or country doesn't match, or a date looks wrong. Resolve before onboarding.
- Red: not listed with no authorisation reference, an end date is present, or the domain appears on the non-compliant file. Don't onboard.
Recommended reading: MiCA CASP Authorisation: What Payment & OTC Firms Need for EU Go-Live, Stablecoin Rules Under MiCA: The EMT/ART Regime for Payment Businesses, Best Crypto Payment Gateways for Merchants (2026, Ranked)